                                     :port 6379}})
 
 (def app
-  (->
+  (routes
     (wrap-defaults
-      (routes
-        resource-routes
-        site-routes
-        sync-routes)
-      (-> site-defaults ; ssl stuff will be handled by nginx
+      (routes sync-routes api-routes)
+      (-> api-defaults
           (assoc-in [:session :cookie-attrs :secure] (= (env :environment) "prod"))
           (assoc-in [:session :store] (carmine/carmine-store *redis-conf*
                                                              {:expiration-secs (* 60 60 24 7)
-                                                              :key-prefix "lpchat"}))
-          (assoc-in [:security :anti-forgery]
-            {:read-token (fn [req] (-> req :params :csrf-token))})))
-      wrap-edn-params))
+                                                              :key-prefix "lpchat"}))))
+      (->
+        (wrap-defaults
+          (routes
+            resource-routes
+            site-routes)
+          (-> site-defaults ; ssl stuff will be handled by nginx
+              (assoc-in [:session :cookie-attrs :secure] (= (env :environment) "prod"))
+              (assoc-in [:session :store] (carmine/carmine-store *redis-conf*
+                                                                 {:expiration-secs (* 60 60 24 7)
+                                                                  :key-prefix "lpchat"}))
+              (assoc-in [:security :anti-forgery]
+                {:read-token (fn [req] (-> req :params :csrf-token))})))
+        wrap-edn-params)))
 
 (defonce server (atom nil))
 

    (let [fail {:status 400 :headers {"Content-Type" "text/plain"}}]
      (cond
        (string/blank? password) (assoc fail :body "Must provide a password")

        (not (invites/verify-hmac hmac (str now token invite_id email))) (assoc fail :body "Invalid HMAC")

        (string/blank? invite_id) (assoc fail :body "Invalid invitation ID")

        ; TODO: be smarter about this
        (not (#{"image/jpeg" "image/png"} (:content-type avatar))) (assoc fail :body "Invalid image")


        :else
        (let [invite (db/with-conn (db/get-invite (java.util.UUID/fromString invite_id)))]

               :session (assoc (req :session) :user-id (user :id))
               :body ""}))))))

  (POST "/logout" req
    {:status 200 :session nil}))

(defroutes api-routes
  (POST "/auth" req
    (if-let [user-id (let [{:keys [email password]} (req :params)]
                       (when (and email password)
                         (db/with-conn (db/authenticate-user email password))))]
      {:status 200 :session (assoc (req :session) :user-id user-id)}
      {:status 401})))

(defroutes resource-routes
  (resources "/"))
